External Watchdog Timer?

[tlf30]

Hello everyone,
First I want to clarify, I am not actually installing an external watchdog timer on any equipment. I was drinking my coffee this morning remembering a heater project I commissioned, and I recalled that the panel had an external watchdog timer connected to the CompactLogix plc. The watchdog timer was built by AB, and I cannot remember how it was wired or really what the function of it was.

So I was wondering if anyone here has implemented an external watchdog on a PLC, and if so, what timer did you use and how was it implemented? Did it simply trigger an ESD, did it reboot the PLC? I'm curious as to how an external watchdog is normally implemented.

Thanks,
Trevor

 

[Tinine]

I have these in the e-stop circuit


They rely on a pulsed input within whatever time-window one chooses. If the input signal gets stuck in either the high or low state, it goes open circuit (frozen program?).


Craig

 

[I_Automation]

I did sort of a similar thing with 2 Delay-On timers


I did it for a stall alarm on a moving agitation drive., a single prox with N.O. and N.C. outputs wired to 2 timers.


If the N.O. was on 3 seconds that timer tripped, if the N.C. was on 6 seconds that timer tripped. If either tripped I set off an alarm beeper.


Changing that to interrupt the E-stop circuit would be simple and monitor a single PLC output with an interposing relay that has to cycle within a decent timeframe.


I have never seen or used any timer to kill the E-stop, but do use a PLC output to control an E-stop Enable relay, or MCR Enable if it's a small machine without an E-stop safety relay.

 

[Tinine]

but do use a PLC output to control an E-stop Enable relay, or MCR Enable if it's a small machine without an E-stop safety relay.

Ah, forgot to mention that the WD becomes the Enable relay.
This is the actual model that I use, OPTO22 compatible.


Craig

 

[I_Automation]

Ah, forgot to mention that the WD becomes the Enable relay.

I did realize that. If the PLC output stopped pulsing that would kill the E-stop safety relay, or drop the MCR/K1 to kill control power if no safety relay.


I actually have a SLC5/03 here on the bench I keep - and have marked with red glitter glue all over - that something like that would be needed.


If that CPU faults or is put in program mode it forgets to turn off all the outputs that were on, letting everything run until there are no humans left on the planet to make the electricity it needs to run (unless the generating plants are fully automated and don't need them either)


EDIT: Also I did a project adding onto a hoist controlled plating line that added a second control panel with it's own PLC. I programmed a pulsing output on each PLC and put in a Stall-Detector AOI in each to monitor the inputs pulsing. (The maintenance director there said it was too critical to rely on Ethernet messaging) Putting one of those WD timers on each PLC output and just running an input to the other PLC would have been easier, especially with the needed solid state interposing relay I had to add as one PLC only had 120VAC outputs available and the other DC inputs.

 

[Tinine]

I actually have a SLC5/03 here on the bench I keep - and have marked with red glitter glue all over - that something like that would be needed.


If that CPU faults or is put in program mode it forgets to turn off all the outputs that were on, letting everything run until there are no humans left on the planet to make the electricity it needs to run (unless the generating plants are fully automated and don't need them either)


EDIT: Also I did a project adding onto a hoist controlled plating line that added a second control panel with it's own PLC. I programmed a pulsing output on each PLC and put in a Stall-Detector AOI in each to monitor the inputs pulsing. (The maintenance director there said it was too critical to rely on Ethernet messaging) Putting one of those WD timers on each PLC output and just running an input to the other PLC would have been easier, especially with the needed solid state interposing relay I had to add as one PLC only had 120VAC outputs available and the other DC inputs.

My kinda guy


It makes total sense that any signal that is commanding something that is potentially hazardous, to require frequent re-commands (mine are 10ms) or it shuts down.
I use lots of slave processors in lieu of I/O expanders for reasons such as this (I don't use PLCs).


Craig


P.S. I see you're in Detroit


I used to be in Wixom.

 

[tlf30]

Thanks for the insight Tinine and I_Automation.

I really have been pondering if there is really much of an application of this. I recently had a PLC go into a major non-recoverable fault, and take down a remote location. I do not think an external watchdog to perform a production stop would have helped in this situation though.

I am beginning to like the idea of using a watchdog on more critical systems though, just for the situation of a PLC getting placed in program mode or having a fault.
Normally we configure the IO output for the ESD/PSD to go low (trigger the shutdown) when the PLC faults or goes into program mode though (which has worked for us in the past) I guess that one cannot predict the nature of a failure though and it could not hurt (much) to have an external watchdog on critical systems to trigger a shutdown.